Amazon Web Services
SAP-C01
AWS Certified
Solutions Architect Professional
Version: Demo
[ Total Questions: 10]
Web: www.dumpsexpert.com
Email: support@dumpsexpert.com
IMPORTANT NOTICE
Feedback
We have developed quality product and state-of-art service to ensure our customers interest. If you have any
suggestions, please feel free to contact us at feedback@dumpsexpert.com
Support
If you have any questions about our product, please provide the following items:
exam code
screenshot of the question
login id/email
please contact us at support@dumpsexpert.com and our technical experts will provide support within 24 hours.
Copyright
The product of each order has its own encryption code, so you should use it independently. Any unauthorized
changes will inflict legal punishment. We reserve the right of final explanation for this statement.
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
Question #:1
The company Security team requires that all data uploaded into an Amazon S3 bucket must be encrypted. The
encryption keys must be highly available and the company must be able to control access on a per-user basis,
with different users having access to different encryption keys.
Which of the following architectures will meet these requirements? (Choose two.)
A. Use Amazon S3 server-side encryption with Amazon S3-managed keys. Allow Amazon S3 to generate
an AWS/S3 master key, and use IAM to control access to the data keys that are generated.
B. Use Amazon S3 server-side encryption with AWS KMS-managed keys, create multiple customer master
keys, and use key policies to control access to them.
C. Use Amazon S3 server-side encryption with customer-managed keys, and use AWS CloudHSM to
manage the keys. Use CloudHSM client software to control access to the keys that are generated.
D. Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM
instances configured in high-availability mode to manage the keys. Use the Cloud HSM client software
to control access to the keys that are generated.
E. Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM
instances configured in high-availability mode to manage the keys. Use IAM to control access to the
keys that are generated in CloudHSM.
Answer: B D
Explanation
http://websecuritypatterns.com/blogs/2018/03/01/encryption-and-key-management-in-aws-kms-vs-cloudhsm-myths-and
s/
Question #:2
A large company has many business units. Each business unit has multiple AWS accounts for different
purposes. The CIO of the company sees that each business unit has data that would be useful to share with
other parts of the company. In total, there are about 10 PB of data that needs to be shared with users in 1,000
AWS accounts. The data is proprietary, so some of it should only be available to users with specific job types.
Some of the data is used for throughput of intensive workloads, such as simulations. The number of accounts
changes frequently because of new initiatives, acquisitions, and divestitures.
A Solutions Architect has been asked to design a system that will allow for sharing data for use in AWS with
all of the employees in the company.
Which approach will allow for secure data sharing in scalable way?
A. Store the data in a single Amazon S3 bucket. Create an IAM role for every combination of job type and
business unit that allows to appropriate read/write access based on object prefixes in the S3 bucket. The
roles should have trust policies that allow the business unit’s AWS accounts to assume their roles. Use
Best IT Preparation Solution - Guaranteed Result
1 of 7
A.
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
IAM in each business unit’s AWS account to prevent them from assuming roles for a different job type.
Users get credentials to access the data by using AssumeRole from their business unit’s AWS account.
Users can then use those credentials with an S3 client.
B. Store the data in a single Amazon S3 bucket. Write a bucket policy that uses conditions to grant read
and write access where appropriate, based on each user’s business unit and job type. Determine the
business unit with the AWS account accessing the bucket and the job type with a prefix in the IAM
user’s name. Users can access data by using IAM credentials from their business unit’s AWS account
with an S3 client.
C. Store the data in a series of Amazon S3 buckets. Create an application running in Amazon EC2 that is
integrated with the company’s identity provider (IdP) that authenticates users and allows them to
download or upload data through the application. The application uses the business unit and job type
information in the IdP to control what users can upload and download through the application. The users
can access the data through the application’s API.
D. Store the data in a series of Amazon S3 buckets. Create an AWS STS token vending machine that is
integrated with the company’s identity provider (IdP). When a user logs in, have the token vending
machine attach an IAM policy that assumes the role that limits the user’s access and/or upload only the
data the user is authorized to access. Users can get credentials by authenticating to the token vending
machine’s website or API and then use those credentials with an S3 client.
Answer: B
Question #:3
A company runs a public-facing application that uses a Java-based web sen/ice via a RESTful API It is hosted
on Apache Tomcat on a single server in a data center that runs consistently at 30% CPU utilization Use of the
API is expected to increase by 10 times with a new product launch The business wants to migrate the
application to AWS with no disruption and needs it to scale to meet demand
The company has already decided to use Amazon Route 53 and CNAME records lo redirect traffic How can
these requirements be met with the LEAST amount of effort?
A. Use AWS Elastic Beanstalk to deploy the Java web service and enable Auto Scaling Then switch the
application to use the new web service
B. Lift and shift the Apache server to the cloud using AWS SMS Then switch the application to direct web
service traffic to the new instance
C. Create a Docker image and migrate the image to Amazon ECS Then change the application code to
direct web service queries to the ECS container
D. Modify the application to call the web service via Amazon API Gateway Then create a new AWS
Lambda Java function to run the Java web service code After testing change API Gateway to use the
Lambda function
Answer: A
Best IT Preparation Solution - Guaranteed Result
2 of 7
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
Question #:4
A large company is migrating its entire IT portfolio to AWS. Each business unit in the company has a
standalone AWS account that supports both development and test environments. New accounts to support
production workloads will be needed soon.
The Finance department requires a centralized method for payment but must maintain visibility into each
group’s spending to allocate costs.
The Security team requires a centralized mechanism to control IAM usage in all the company’s accounts.
What combination of the following options meet the company’s needs with LEAST effort? (Choose two.)
A. Use a collection of parameterized AWS CloudFormation templates defining common IAM permissions
that are launched into each account. Require all new and existing accounts to launch the appropriate
stacks to enforce the least privilege model.
B. Use AWS Organizations to create a new organization from a chosen payer account and define an
organizational unit hierarchy. Invite the existing accounts to join the organization and create new
accounts using Organizations.
C. Require each business unit to use its own AWS accounts. Tag each AWS account appropriately and
enable Cost Explorer to administer chargebacks.
D. Enable all features of AWS Organizations and establish appropriate service control policies that filter
IAM permissions for sub-accounts.
E. Consolidate all of the company’s AWS accounts into a single AWS account. Use tags for billing
purposes and IAM’s Access Advice feature to enforce the least privilege model.
Answer: B D
Explanation
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-what-is.html
Question #:5
A company has a data center that must be migrated to AWS as quickly as possible. The data center has a 500
Mbps AWS Direct Connect link and a separate, fully available 1 Gbps ISP connection. A Solutions Architect
must transfer 20 TB of data from the data center to an Amazon S3 bucket.
What is the FASTEST way transfer the data?
A. Upload the data to the S3 bucket using the existing DX link.
B. Send the data to AWS using the AWS Import/Export service.
C. Upload the data using an 80 TB AWS Snowball device.
D.
Best IT Preparation Solution - Guaranteed Result
3 of 7
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
D. Upload the data to the S3 bucket using S3 Transfer Acceleration.
Answer: D
Explanation
https://aws.amazon.com/s3/faqs/
Question #:6
A company is migrating its on-premises build artifact server to an AWS solution. The current system consists
of an Apache HTTP server that serves artifacts to clients on the local network, restricted by the perimeter
firewall. The artifact consumers are largely build automation scripts that download artifacts via anonymous
HTTP, which the company will be unable to modify within its migration timetable.
The company decides to move the solution to Amazon S3 static website hosting. The artifact consumers will
be migrated to Amazon EC2 instances located within both public and private subnets in a virtual private cloud
(VPC).
Which solution will permit the artifact consumers to download artifacts without modifying the existing
automation scripts?
A. Create a NAT gateway within a public subnet of the VPC. Add a default route pointing to the NAT
gateway into the route table associated with the subnets containing consumers. Configure the bucket
policy to allow the s3:ListBucket and s3:GetObject actions using the condition IpAddress and the
condition key aws:SourceIp matching the elastic IP address if the NAT gateway.
B. Create a VPC endpoint and add it to the route table associated with subnets containing consumers.
Configure the bucket policy to allow s3:ListBucket and s3:GetObject actions using the condition
StringEquals and the condition key aws:sourceVpce matching the identification of the VPC endpoint.
C. Create an IAM role and instance profile for Amazon EC2 and attach it to the instances that consume
build artifacts. Configure the bucket policy to allow the s3:ListBucket and s3:GetObjects actions for the
principal matching the IAM role created.
D. Create a VPC endpoint and add it to the route table associated with subnets containing consumers.
Configure the bucket policy to allow s3:ListBucket and s3:GetObject actions using the condition
IpAddress and the condition key aws:SourceIp matching the VPC CIDR block.
Answer: B
Question #:7
A company is planning to deploy a new business analytics application that requires 10.000 hours of compute
time each month. The compute resources can have flexible availability, but must be as cost-effective as
possible. The company will also provide a reporting service to distribute analytics reports, which needs to run
at all times
Best IT Preparation Solution - Guaranteed Result
4 of 7
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
How should the solutions architect design a solution that meets these requirements?
A. Deploy the reporting service on a Spot Fleet. Deploy the analytics application as a container in Amazon
ECS with AWS Fargate as the compute option Set the analytics application to use a custom metric with
Service Auto Scaling.
B. Deploy the reporting service on an On-Demand Instance. Deploy the analytics application as a container
in AWS Batch with AWS Fargate as the compute option Set the analytics application to use a custom
metric with Service Auto Scaling.
C. Deploy the reporting service as a container in Amazon ECS with AWS Fargate as the compute option.
Deploy the analytics application on a Spot Fleet. Set the analytics application to use a custom metric
with Amazon EC2 Auto Scaling applied to the Spot Fleet.
D. Deploy the reporting service as a container in Amazon ECS with AWS Fargate as the compute option.
Deploy the analytics application on an On-Demand Instance and purchase a Reserved Instance with a
3-year term. Set the analytics application to use a custom metric with Amazon EC2 Auto Scaling
applied to the On-Demand Instance.
Answer: D
Question #:8
A company has an internal AWS Elastic Beanstalk worker environment inside a VPC that must access an
external payment gateway API available on an HTTPS endpoint the public internet Because of security
policies, the payment gateway's Application team can grant access to only one public IP address.
Which architecture will set up an Elastic Beanstalk environment to access the company's application without
making multiple changes on the company's end?
A. Configure the Elastic Beanstalk application to place Amazon EC2 instances in a private subnet with an
outbound route to a NAT gateway in a public subnet Associate an Elastic IP address to the NAT
gateway that can be whitelisted on the payment gateway application side
B. Configure the Elastic Beanstalk application to place Amazon EC2 instances in a public subnet with an
internet gateway Associate an Elastic IP address to the internet gateway that can be whitelisted on the
payment gateway application side
C. Configure the Elastic Beanstalk application to place Amazon EC2 instances in a private subnet Set an
https_proxy application parameter to send outbound HTTPS connections to an EC2 proxy server
deployed in a public subnet Associate an Elastic IP address to the EC2 proxy host that can be whitelisted
on the payment gateway application side
D. Configure the Elastic Beanstalk application to place Amazon EC2 instances in a public subnet Set the
https_proxy and no_proxy application parameters to send non-VPC outbound HTTPS connections to an
EC2 proxy server deployed in a public subnet Associate an Elastic IP address to the EC2 proxy host that
can be whitelisted on the payment gateway application side
Answer: C
Best IT Preparation Solution - Guaranteed Result
5 of 7
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
Question #:9
A company hosts a web application on AWS in the us-east-1 Region. The application server are distributed
across three Availability Zones behind an Application Load Balancer. The database is hosted in MYSQL
database on an Amazon EC2 instance. A solutions architect needs to design a cross-Region data recovery
solution using AWS services with an RTO of less than 5 minutes and an RPO of less than 1 minute. The
solutions architect is deploying application servers in us-west-2, and has configured Amazon Route 53 hearth
checks and DNS failover to us-west-2.
Which additional step should the solutions architect take?
A. Migrate the database to an Amazon RDS for MySQL instance with a cross-Region read replica in
us-west-2.
B. Migrate the database to an Amazon Aurora global database with the primary in us-east-1 and the
secondary in us-west-2.
C. Migrate the database to an Amazon RDS for MySQL instance with a Multi-AZ deployment.
D. Create a MySQL standby database on an Amazon EC2 instance in us-west-2
Answer: B
Question #:10
A company has an internal application running on AWS that is used to track and process shipments in the
company's warehouse. Currently, after the system receives an order, it emails the staff the information needed
to ship a package. Once the package is shipped, the staff replies to the email and the order is marked as
shipped.
The company wants to stop using email in the application and move to a serverless application model.
Which architecture solution meets these requirements?
A. Use AWS Batch to configure the different tasks required to ship a package. Have AWS Batch trigger an
AWS Lambda function that creates and prints a shipping label. Once that label is scanned, as it leaves
the warehouse, have another Lambda function move the process to the next step in the AWS Batch job.
B. When a new order is created, store the order information in Amazon SQS. Have AWS Lambda check
the queue every 5 minutes and process any needed work. When an order needs to be shipped, have
Lambda print the label in the warehouse. Once the label has been scanned, as it leaves the warehouse,
have an Amazon EC2 instance update Amazon SQS.
C. Update the application to store new order information in Amazon DynamoDB. When a new order is
created, trigger an AWS Step Functions workflow, mark the orders as "in progress," and print a package
label to the
warehouse. Once the label has been scanned and fulfilled, the application will trigger an AWS Lambda
function that will mark the order as shipped and complete the workflow.
Best IT Preparation Solution - Guaranteed Result
6 of 7
Most Updated & Latest Questions
Amazon Web Services - SAP-C01
D. Store new order information in Amazon EFS. Have instances pull the new information from the NFS
and send that information to printers in the warehouse. Once the label has been scanned, as it leaves the
warehouse, have Amazon API Gateway call the instances to remove the order information from Amazon
EFS.
Answer: C
Best IT Preparation Solution - Guaranteed Result
7 of 7
About dumpsexpert.com
dumpsexpert.com was founded in 2007. We provide latest & high quality IT / Business Certification Training Exam
Questions, Study Guides, Practice Tests.
We help you pass any IT / Business Certification Exams with 100% Pass Guaranteed or Full Refund. Especially
Cisco, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on.
View list of all certification exams: All vendors
We prepare state-of-the art practice tests for certification exams. You can reach us at any of the email addresses listed
below.
Sales: sales@dumpsexpert.com
Feedback: feedback@dumpsexpert.com
Support: support@dumpsexpert.com
Any problems about IT certification or our products, You can write us back and we will get back to you within 24
hours.